Results 1 to 8 of 8

Thread: Help! (Please)

  1. #1
    New Lounger
    Join Date
    Jul 2014
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Help! (Please)

    Hi,

    I am new here, and writing in a minor panic re the possible unauthorised accessing of my confidential work..I use Windows 8on HP and Toshiba laptops.

    My SD card went missing out of my wallet, turning up two hours later. The person who claimed to have found it, has,I fear, accessed it and copied documents from it. To check, I put the card in my lap top, and a number of the Word filesand one Jpeg were shown to be accessed at 00.00 on 29 July 2014 in the Properties tab.The SD card was sitting on my desk at that time, so that was impossible. However, I reset the time and date on my laptop, and it was possible to enter a file with a falsified date and time on the laptop, which, when a test file was opened, was then recorded in the file Properties. About 10 files were showing the aforementioned odd property listing, so I am very suspicious. If what I suspect, has happened, can the identity of the computer that accessed the files be traced via the forensic file data or the SD card? Does the SD and or files in question even hold that sort of forensic data? Would a specialist company be able to retrieve this?

    Any help hugely appreciated!

    Thanks,
    Lizzie

  2. #2
    Super Moderator CLiNT's Avatar
    Join Date
    Dec 2009
    Location
    California & Arizona
    Posts
    5,529
    Thanks
    130
    Thanked 500 Times in 460 Posts
    If what I suspect, has happened, can the identity of the computer that accessed the files be traced via the forensic file data or the SD card?
    Yes, and no.
    Most any identfying information garnered, will most likely be a meaningless hash number relavant only to the computer that the drive has been accessed by.

    I'd be more concerned that something has been changed on the card; loss of data/manipulation of same, or that some special treat has been added to the disk, like a virus, rootkit, or trogen.
    Last edited by CLiNT; 2014-07-29 at 03:37.
    DRIVE IMAGING
    Invest a little time and energy in a well thought out BACKUP regimen and you will have minimal down time, and headache.

    Windows 8.1, 64 bit
    Motherboard: DX58SO2*Chipset: X58 Express/Intel ICH10*BIOS: SOX5820J.86A.0888.2012.0129.2203*Processor: Intel Core i7 CPU X 990
    GPU: Nvidia GTX 580*Memory: Corsair 12 GB, 4x3@1600*PSU: Corsair HX1000*Hard drives: REVO X2 160GB*OCZ VERT X3 120GB*5 mechanical storage drives (12 TB) total.

  3. #3
    New Lounger
    Join Date
    Jul 2014
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Thank you so much for your reply, Clint, I really appreciate it.

    I honestly don't think the person who I suspect did this, is quite that advanced, although I could be wrong. I think I just need to prove that the SD card was accessed by a laptop other than mine...how would I get the hash number and do you know if there would there be a time stamp along with the hash number??

    Thanks,
    Lizzie
    Last edited by lizziejamescaroon; 2014-07-29 at 08:47.

  4. #4
    2 Star Lounger
    Join Date
    Jun 2011
    Location
    Hampshire (the old one)
    Posts
    157
    Thanks
    2
    Thanked 16 Times in 16 Posts
    How did the person who found it get it back to you? They may have just looked at it to see who the owner was.

  5. #5
    New Lounger
    Join Date
    Jul 2014
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts
    I live with them and had told them it had gone missing from my wallet (I have to carry it around as they do not respect boundaries i.e. have gone through my phone in the past etc). It went missing from my wallet (which was in my bedroom) and they claimed to have 'found' it in my room a couple of hours after I had realised it had gone missing...

  6. #6
    New Lounger
    Join Date
    Jul 2014
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Is there any way meta data of an SD card can be false??

  7. #7
    Silver Lounger
    Join Date
    Oct 2012
    Posts
    2,147
    Thanks
    12
    Thanked 248 Times in 241 Posts
    Quote Originally Posted by lizziejamescaroon View Post
    Is there any way meta data of an SD card can be false??
    Yes, but that would mean someone accessed it and knowingly falsified it. Some things could just be a result of improper settings such as date from whatever device recorded the meta data as well.

  8. #8
    New Lounger
    Join Date
    Jul 2014
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Falsifying the meta data is what I suspect. Falsified access at a time when the SD card was returned to me, but it was not in a machine at the time of stated access and had not been put in a machine since it had been 'found'. I put it in the machine at about 1.30 am this morning and the access time stamp was 00.00 29/07.14...so unless inaccurate time stamp, those files must have been accessed at a falsified time...surely?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •